Fractional Leadership & GRC
A Kellwick vCISO provides fractional information security leadership: security strategy, governance, risk prioritisation, supplier security, incident preparedness and reporting to executives and the board - on a defined monthly capacity rather than a full-time salary.
It is a leadership role, not a label for every monthly compliance task. If what you need is upkeep of a certified ISMS, Managed ISMS is the better fit; if you need coordination across several frameworks, a Fractional GRC Lead.
Who needs it
The same role answers different questions depending on who sponsors it.
Needs: Senior security leadership before a full-time executive hire makes sense - usually because customers, investors or a regulator have started asking who owns security.
Gets: A named security lead, a roadmap you can explain to customers and investors, and decisions put to you with options and costs rather than alarms.
Needs: Someone to set security priorities and run governance without pulling engineering into compliance work it does not need to do.
Gets: Risk-ranked priorities, policies and standards that fit how you build, and a governance cadence that asks engineers for decisions and evidence, not paperwork.
Needs: Security responsibilities, controls and reporting organised across teams, suppliers and frameworks that today live in different places.
Gets: Clear ownership, one risk picture, a supplier security view and a monthly report that says what moved and what needs a decision.
Needs: Security risk reported in terms the board can oversee - exposure, trend, decisions required - rather than a list of tools.
Gets: A quarterly board risk report where included, and a security lead who can answer the board's questions directly.
Needs: Security leadership that works with the governance and operational resilience obligations that apply to you - DORA in the EU, FINMA expectations in Switzerland, or your regulator's equivalent.
Gets: Security strategy and reporting aligned to those obligations, coordinated with your compliance function. The management body's own responsibilities stay with it.
The problem
Security decisions are made by whoever is closest - often an engineering lead - with no strategy and no one to explain the position to customers or the board.
Due diligence, enterprise procurement and renewals ask who is responsible for security and how risk is governed. A policy pack does not answer that.
Spend and effort follow whatever was asked most recently, not the risks that matter most.
ISO 27001, a customer's DORA or NIS2 clauses and AI governance each arrive separately, and nobody is joining them up into one programme.
Why an external specialist
Responsibilities
A named consultant owns delivery of the contracted work. That does not replace the statutory responsibilities of your directors or management body.
| Area | Your organisation | Kellwick vCISO |
|---|---|---|
| Legal and regulatory accountability | Retains it. Directors and the management body remain accountable under company law and any applicable regulation. | Advises on obligations and reports on the security position within the agreed mandate. |
| Risk acceptance | Decides which risks to accept, treat or transfer, and signs off. | Analyses and prioritises risks, sets out options and records the decision taken. |
| Corporate governance | Owns board and committee structures and their decisions. | Prepares security input for them and attends where agreed. |
| Budget | Approves security spend. | Recommends investment priorities with rationale. |
| Operational controls | Owns and operates them - IT, engineering, HR, suppliers. | Defines expectations, checks evidence and follows up on gaps. |
| Contracted deliverables | Provides access, people and timely decisions. | Owns delivery: roadmap, reports, risk register, governance records, recommendations. |
The first 90 days
The first quarter establishes the mandate, the risk picture and the cadence. Major remediation usually continues well beyond it - the 90 days are about direction and ownership, not finishing everything.
Days 1-30
Days 31-60
Days 61-90
What you receive
What you receive each month and quarter, adjusted to the agreed scope and capacity:
What we need from you
See what you receive
Three examples built for a fictional company - not client documents. They show the structure and depth of what a vCISO produces; yours are shaped to your organisation.
Engagement levels
Three recurring services with different jobs. Capacities are guides, not promises of unlimited work; higher capacity is agreed as a custom engagement.
| Area | Managed ISMS | Fractional GRC Lead | vCISO |
|---|---|---|---|
| What it is | Operational upkeep of an ISO 27001 ISMS | Coordination of agreed compliance workstreams across frameworks | Senior information security leadership |
| Monthly capacity (guide) | Up to 1 advisory day | Up to 3 advisory days | Up to 5 advisory days |
| Typical outputs | Risk register and SoA upkeep, evidence schedule, corrective actions, management review preparation | Obligation tracking, control-owner follow-up, audit readiness oversight, monthly management report | Security strategy and roadmap, risk prioritisation, executive reporting, quarterly board report where included |
| Executive leadership | No | Management reporting, not security leadership | Yes, within the agreed mandate |
| Frameworks | ISO 27001 | ISO 27001, ISO 9001, ISO 42001, DORA, NIS2 - as agreed | Security across ISO 27001, ISO 42001, DORA, NIS2, SOC 2 - as agreed |
Deliverables are planned against the purchased capacity. Larger pieces of work are scheduled across the quarter.
1 day a month
In a management review month, preparation takes most of the day.
3 days a month
An internal audit is coordinated, not performed, within this capacity.
5 days a month
A quarterly board report, a tabletop exercise and a supplier assurance round are spread across the quarter - they do not all fit in one month.
ISO and regulatory programmes
The vCISO can direct the security side of an ISO 27001 ISMS, an ISO 42001 AI management system, and the ICT risk parts of DORA and NIS2 where they apply - one risk picture and one roadmap rather than a programme per framework. Quality management is not CISO work; where you run ISO 9001 too, it is supported through Managed QMS or Managed IMS.
Who delivers it
Each engagement has a named lead, introduced in the proposal. Our auditors hold ISO/IEC 27001 Lead Auditor, ISO 9001 Lead Auditor and ISO/IEC 42001 Lead Auditor certification.
Incidents
Included, within capacity:
Not included unless separately staffed and contracted:
Scope and pricing
The proposal states the mandate, the monthly capacity and what is reported to whom. The price depends on:
Monthly retainer, quoted after a scoping conversation. Work beyond the agreed capacity needs a written scope extension; unused capacity does not roll over.
Delivery
Boundaries
Auditors must remain independent of the activities they audit. Where Kellwick has supported implementation or ongoing management, any subsequent internal audit is subject to an independence and conflict-of-interest review. The assigned auditor must not have participated in the work being audited. Where sufficient objectivity and impartiality cannot be assured, Kellwick will decline the affected scope or recommend independent external assurance. A vCISO who runs your security programme can coordinate the internal audit of it, but never performs it. The audit goes to an independent Kellwick auditor or a provider you choose.
Related services
From the blog
A practical test for choosing between a vCISO and a Managed ISMS: what each produces, the decisions each one supports, and the signs you have outgrown one.
Read →vCISO & Security GovernanceA growing regulated-tech company needs security leadership long before a full-time CISO is justified. Here is how to bridge the gap without over-hiring.
Read →Managed Systems & IMSA management review agenda that covers every required input and ends each item with a decision, an owner and a date - and the record auditors expect.
Read →Questions
The responsibilities are similar - strategy, governance, risk, reporting - but delivered at a fractional capacity agreed each month. A vCISO suits organisations that need senior judgement and ownership of the programme, but not yet a full-time executive.
Managed ISMS keeps an ISO 27001 system running: risk register, SoA, evidence schedule, corrective actions, management review preparation. It does not provide executive security leadership. A vCISO sets security strategy and priorities, reports to executives and the board, and can oversee the ISMS as part of a wider programme.
No. Directors and the management body keep their legal and regulatory accountability, risk acceptance and budget authority. The vCISO owns delivery of the contracted work and gives the board the analysis and reporting it needs to exercise its oversight.
The vCISO prepares incident governance - roles, escalation, decision-making and reporting duties - and can coordinate during an incident within the agreed capacity. Technical response, forensics and containment need a specialist incident response provider, which we can help you select and contract in advance.
No. An internal audit must be objective and impartial, and nobody audits their own work. The vCISO can coordinate the audit; an independent Kellwick auditor or another provider performs it.
Yes, for the security and ICT risk parts of those obligations where they apply to you, coordinated with your compliance and legal functions. Applicability depends on your sector, entity status and jurisdiction, and is confirmed first.
Not as a CISO service. Quality management needs its own specialists; see Managed QMS or Managed IMS, which can run alongside a vCISO engagement.
Tell us where security sits today, what is driving the question and who would sponsor the role. We will say whether a vCISO, a GRC lead or Managed ISMS fits - and what the first 90 days would look like.
Kellwick is an independent consulting and internal audit practice. We are not a certification body and do not issue ISO certificates. Certification decisions are made only by accredited certification bodies.